Re: Prelude-lml rule sets...

Scott,
	My only other suggestion would be to set both the source and the target 
IP address to the agent's IP address IF one of the source or target is 
null. That would be particularly useful for file-system integrity change 
correlation events.

	By the way, the changes that you've implemented... rock. Nice work!

Regards,
	Adriel T. Desautels
	Chief Technology Officer
	Netragard, LLC.
	Office : 617-934-0269
	Mobile : 617-633-3821
	http://www.linkedin.com/pub/1/118/a45

	Join the Netragard, LLC. Linked In Group:
	http://www.linkedin.com/e/gis/48683/0B98E1705142

---------------------------------------------------------------
Netragard, LLC - http://www.netragard.com  -  "We make IT Safe"
Penetration Testing, Vulnerability Assessments, Website Security

Netragard Whitepaper Downloads:
-------------------------------
Choosing the right provider : http://tinyurl.com/2ahk3j
Three Things you must know  : http://tinyurl.com/26pjsn


ScottO wrote:
> Simon,
> 
> Do you have the required Twisted packages installed?
> 
> As per the release notes:
> 
> 
> - Implement Prewikka Asynchronous DNS resolution in alert view
>   as well as message summary (require twisted.names and twisted.internet),
>   see the additional dns_max_delay settings parameters in prewikka.conf.
> 
> 
> On Mon, Apr 28, 2008 at 3:28 PM, Simon Smith <[email protected]> wrote:
> 
>> ScotO,
>>        I've upgraded my preqikka but it does not seem to be resolving IP
>> addresses. Is there any documentation on this? Am I missing something
>> specific that is required for proper functionality?
>>
>> ScottO wrote:
>>
>>> There already is in Prewikka.  Have a look at the second bullet down in
>>> http://prelude-ids.org/download/releases/prewikka-0.9.14.txt.
>>>
>>> scotto
>>>
>>> On Thu, Apr 24, 2008 at 5:11 PM, Simon Smith <[email protected] <mailto:
>>> [email protected]>> wrote:
>>>
>>>    Greetings,
>>>           Will there ever be a function in prelude that performs
>>>    lookups on IP
>>>    addresses, or at least allows a user to apply a name to an IP? Is
>>> there
>>>    one that I am missing already?
>>>
>>>
>>>    --
>>>
>>>    - simon
>>>
>>>    ----------------------
>>>    http://www.snosoft.com
>>>
>>>    _______________________________________________
>>>    Prelude-user site list
>>>    [email protected] <mailto:[email protected]>
>>>    http://lists.prelude-ids.org/mailman/listinfo/prelude-user
>>>
>>>
>>>
>> --
>>
>> - simon
>>
>> ----------------------
>> http://www.snosoft.com
>>
>>
> _______________________________________________
> Prelude-user site list
> [email protected]
> http://lists.prelude-ids.org/mailman/listinfo/prelude-user

_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user

begin:vcard
fn:Adriel T Desautels
n:Desautels;Adriel T
org:Netragard, LLC.
adr:;;17 Sheldon Road;Mendham ;NJ;;USA
email;internet:[email protected]
title:Chief Technology Officer
tel;work:617-934-0269
tel;cell:617-633-3821
x-mozilla-html:FALSE
url:http://www.netragard.com
version:2.1
end:vcard